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South Australian Apple Users Club, Inc. 


Postal address 
SAAllC, Inc. 

PO Box 322 
Prospect SA 5082 


Club Committee 
1988-1989 


President 

Bob Owen (Apple ][ & Mac) 

Ph (08) 293 1313 

Vice President 

Peter Jenkins (Apple ][ & Mac) 

Ph (08) 31 9543 

Treasurer 

Peter McKay (Apple ][ GS) 

Ph (08) 262 3387 

Secretary 
Ian Bagust(Mac) 

Ph (08) 293 7183 

Newsletter Editor 
Chris Loft (Mac) 

Apple ][ Editor 

Keith Zerna (Apple ][ GS) 

Program Co-Ordinator 
Peter Jenkins (Apple ][ & Mac) 

Macintosh Disk Librarian 
Brenton Smith (Mac SE) 

Apple ][/GS Disk Librarian 

Garry Percy (Apple //c) 

Magazine Librarian - Apple ][ 

George Wissenburg (Apple ][ GS) 

Magazine Librarian - Mac 

Michael Coleman (Mac) 

Assisting 
Ernie Geier (Mac) 

Assisting Committee Members 
Ray McVey, 

Grant Ward, 

Don Facchino, 

Dino Porcaro. 



Membership Fees 

Individuals or Schools 

$30.00 

Corporations/Businesses $50.00 

Extended memberships 

available 

Library Disks 

Public Domain disks 
Apple ][ (5.25") 

$4.00 ea 

Apple ][ GS (3.5") 

$7.00 ea 

Macintosh 

$8.00 ea 

Boxes of 10 blank disks 

5.25" DSDD 

$10.00 

3.5" DSDD 

$30.00 

Disk Catalogues 1989 

$2.00 ea 


All programs supplied on club disks have 
been written using original Apple 
equipment; no guarantee is given by the 
club for use of programs on Apple 
compatible computers. 

Postal rates for disks 
1 to 9 disks add $2.00 

10 disks add $3.00 

Greater than 10 disks add $4.00 

The above rates include Australia Post 
insurance worth $50. 

Please add an additional $2.50 for 
insurance cover worth $200. 

Public domain disk purchases of $20 or 
more from S.A. country members 
(Postcodes 5200 or greater) or interstate 
members will be posted FREE. The 
additional insurance charge of $2.50 is 
still payable if you require .the extra cover. 

Meetings 

Apple II meetings are held at 7.30pm on 
the 1st Friday of each month; Macintosh 
meetings are held at 7.30pm on the 3rd 
Friday of each month, at the rear of the 
Prospect Town Hall, Prospect Road, 
Prospect. 


Information page 


Contributing Articles 

Articles will be accepted from anyone 

wishing to contribute material for 

publication in the newsletter, provided 

it is oriented towards Apple 

computers. 

It can be of any topic relating to Apple 
computers, and may be typed printed 
normally spaced on standard A4 
paper, or preferably on disk as a plain 
text document. Send articles to the 
Newsletter Editor c/- above postal 
address or hand to a club committee 
member at any meetings. All disks will 
be returned. 

Members who contribute an article 
with a length of two pages or greater 
will receive their choice of club disk 
from the library on request. 

Advertising 

Small advertisements (quarter page or 
less) from financial club members will 
be accepted and published free of 
charge provided they are signed by 
the person(s) placing the 
advertisement. 

Business advertising rates are by 
negotiation or as follows: 

1/4 page $18.00 

1/2 page $30.00 

Full page $50.00 

Back cover $70.00 

All advertisements will be printed 
under the proviso that they do not 
conflict with the best interests of the 
Club. 

Copyright 

Applesauce is the official newsletter 
magazine of the SAAUC, Inc. This 
publication is copyright ©1989 by 
SAAUC, Inc. Authors and advertisers 
express their own opinions and are 
responsible for the accuracy of their 
submitted material. 

Permission is granted for the 
reproduction of original articles 
contained in this issue by any non¬ 
profit organisation provided the 
author, title and publication credits are 
given. 
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Presidential Desktop 
SEPTEMBER 1989 

The club have been collecting Demonstration Software to provide a 
library of disks that could be freely accessed by members. We have 
collected a good range of applications from numerous sources. The li: 
is published in this addition of Applesauce. 

The arrangement for access to this library is by ordering your 
requirements at a meeting and paying the cost only of the blank disk, 

which is $3.00. 

Due to the number of problems of computer virus infections at preser 
I we do not wish to copy these demos to your disks. 

The disk will be copied and sent to you, collected by arrangement, or 
hand delivered at the next meeting. Not all of the programmes have 
been tested - if you receive on that doesn't work, then please let me 
know. 

; Following the National Apple Convention, we have received some 
| copies of training notes, newsletters and other educational type manuals 
from Apple. We have published the list in this edition. These can be 
borrowed by members, and will be made available to special user 
groups to assist their activities. Why not start up a small special user 
: group and develop a better understanding of Desk Accessories. 

We suffered rather poor attendances at the past months meeting, 
probably due to the cold weather, but if you were not there then you 
missed out on some inside information on the HGs presented by Keith 
Zerna, and at the Mac meeting Michael Coleman presented a very 
interesting talk and demonstration on what to do when you loose your 
data. Symantec Utilities was used by Michael for the demonstration. 

Last year I wrote the following plea for magazine articles - 

Once again, I must remind members that the committee require articles 
for Applesauce. We would like some members who would be prepared 
to write some regular articles on subjects such as Programming (all 
languages). Applications 
(Appleworks, Excel, etc., 
etc.), Utilities available 
for Apple ][ and 
Macintosh. I extend our 
sincere thanks to all members 
that have provided articles in the 
past, you have been a part of our 
magazine and we trust that your support 
will continue in the future. 

We still have a great need for these 
contributions, please contact the Editors for 
further information. 

I look forward to seeing you at the September general 
meeting, and the Mac Special Interest meeting. 

Regards 

dwm 
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Next main Apple ][ meeting 
Friday September 1 at 7.30pm 
at Rear of Prospect Town Hall. 

This meeting will feature desktop 
publishing on the Apple ][Gs using 
Publish It V2 and also have a look at 
output from the ImageWriter ][ and an 
Epson MX80. 

Next Macintosh meeting 

Friday September 15 at 7.30pm 

at Rear of Prospect Town Hall. 


Next committee meeting 
Friday September 8 at 7.30pm 
at the Aiport meeting room 



Free advertising to club members. Please supply 
your ads on paper and include your signature. On 
request ads may be repeated. 

For Sale • Wanted • Exchange • Etc 

For Sale: Games for the Apple // series 

GhostBusters, Alcazar, Bards Tale II, Marble 
Madness, Airheart, Bruce Lee, Captain Goodnight, 
Murder on the Mississippi, Hacker II. 

All with original manuals and boxes. 

Will sell as a bundle or will separate. Any 
reasonable offer accepted. 

Phone 2650364 between 3-4pm or After Hours and 
ask for Keith Zerna or see me at the meetings. 

Phone 269 1278 bus hours or 

(085) 56 2529, or 79 4287 ah. 

For Sale: Apple ] [e, 80 col card. Super Seerial card, 
2 disk drives , (no monitor) $600 Excellent 
condition includes some software. 

ImageWriter I $450 

Contact: Bob Owen 293 1313 


Magazine dosing date 

for the October magazine - 
Friday September 14 
at the Macintosh meeting 

Coming events 
October Club Meetings 

Main meeting - October 6 
Mac meeting - October 15 

Magazines 

If you are holding any of the club's magazines, 
please return them to Michael Coleman so that 
others can borrow them. 

AppleWorks Templates 

If anyone is interested in AppleWorks Templates, 
please contact George Wisenberg at a meeting. 
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APPLESAUCE (3 Demo disk library 


TITLE 

DISTRIBUTOR 

TYPE 

VERSION 

COMMENTS File Size 

4th Dimension 


Database 

1.0.6 

Application Disk 

737K 

4th Dimension 


Database 

4.0 

Data Disk #1 

761K 

4th Dimension 


Database 

4.0 

Data Disk #2 

306K 

Click Art Sampler 

T/Maker Co. 

Graphics 


Images from ClickArt series 

264K 

Multi Ad-Creator 

Trio Technologies Graphic Arts 

1.0 

Advertisement creator 

717K 

CricketGraph 


Graphs 

1.0 

Graphical display of data 

215K 

dBase Mac 

Ashton-Tate 

Database 


Faulty 

631 K 

Double Helix II 


Relational database 


Generates applications 


Dreams 

IDD 

Drawing 


Includes sample files. 

775K 

Excel 

Microsoft 

Spreadsheet 

1.5 


170K 

Expressionist 

Allan Bonadio Ass.Formulae 

2.0 

Mathematical Formulae 

243K 

Fast Forms 

Shana 

Forms Constuction 

1.1 

Forms Construction Kit 

350K 

Filemaker 

Nashoba Systems 

Database 

4.0 


740K 

Freehand 

InfoMagic 

Graphic Arts 

2.0 

Slideshow Tour 

785K 

Full Impact 

Ashton-Tate 

Spreadsheeet 

1.1 

Limited working version 

766K 

Full write Professional Ashton-Tate 

Word Processing 

1.0 

Applications Disk 

781 K 

Fullwrite Professional Ashton-Tate 

Word Processing 

1.0 

Dictionary Disk 

760K 

Hyper#1 


HyperCard 


SmartForms Design Tour 

778K 

Hyper #2 


HyperCard 


S.Form Assistant, Formulator 738K 

Hyper #3 


HyperCard 


Empire Ridge (Faulty) 

761 K 

icon-it! 

Olduvai Software 

Icon Developer 


Time limited demo 

94 K 

Illustrator 88 

Adobe 

Graphic Arts 

1.0 

Slideshow Tour 

777K 

ImageStudio 

LetraSet 

Image processor 



388K 

Intermail 


Desk Accessory 



275K 

MacDraft 

IDD 

Drafting/Drawing 



229K 

MacDraw 

Claris 

Drawing 




MacDraw 

Claris 

Drawing 

1.9.6 



MacPaint II 

Claris 

Paint 




MacProject II 

Claris 

Project planning 




MacWrite 

Claris 

Word Processing 

5.0 



Nisus 


Word-processing 




Pagemaker 

Aldus 

Desk-top Publishing. 

3.0 



Persuasion 

Aldus 

Presentations 

1.0 



Power Draw 


3D drawing 




Profits 


Database/charting 


Application and Data 

400K 

Quickeys 

CE Software 

Keyboard macros 

1.1 


86 K 

ReadySetGo 

LetraSet 

Desk-top Publishing. 

4.0a 



Statview II 

Pica 

Statistics 




Statview SE + Graphics Pica 

Statistics 


Suits Mac Plus and SE 


Sun Clock 






Swivel 3D 

Pica 

Graphics 


three dimensional 


The Big Thesaurus 

Pica 

Thesaurus 



601 K 

Versacad 


CAD 




VideoWorks 


Animation 




Wings Macintosh 

Informix 

Spreadsheet 

1.0 



Wingz Test Flight 

Informix 

Spreadsheet 

1.0 



Word 


Word Processing 

3.0 



Word Perfect 


Word Processing 




WriteNow 

T/Maker Co. 

Word Processing 

2.0 



Xpress 

Quark 

Desk-top Publishing. 

1.11 


743 K 
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TITLE 


DESCRIPTION 


Everything You Need to Know About Computers 

Using the Macintosh in Education 

Using the Macintosh in Primary School 

Using Computers in Primary School 

Integrating Digital Equipment Corporation 

Integrating MS-DOS based PC's 

Connecting to IBM Hosts 

Networking the Macintosh 

Wings for the mind - July 87 

Wings for the mind - June 88 

Wings for the mind - February 89 

The Apple Australia Special Education 

The Apple IICs Software Directory 1987 

Introduction to the Macintosh 

Mastering Macintosh 

Using the Macintosh in Screen Printing 

Learning Macwrite 

Desktop Publishing on the Macintosh 
"On Your Mac - Ready,Set,Go!" 

Getting to work with Microsoft Works 

Using Macintosh Desk Accessories 

Getting What You Font from your Macintosh 

Macintosh and Music 

lIGs and Music 

Learning MacWrite 5.0 

Quick Guide to MacDraw 


(but were afraid to ask Kids) 

Education Resouce 

Education Resouce 

Education Resouce 

Networking and Communications 

Networking and Communications 

Networking and Communications 

Networking and Communications 

Newsletter of the Aust Uni. Con. 

Newsletter of the Aust Uni. Con. 

Newsletter of the Aust Uni. Con. 

Resource Directory 

Software Directory 1987 

Training 

Training 

Training 

Training 



These demonstrations disks, books and 
training manuals are available from the 
various club librarians, for further details see 
the Presidential Pen (page 3), or contact on of 
the club's librarians. As more items are 
received this list will be updated. 
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SoftSwitch 

Review 

by Terry Cass 
Reprinted from GS Users 

The Apple iIGS is amazing. It runs just about any 
software written for the earlier Apple II computers. And 
it has impressive sound and graphics, making it a 
natural for graphics, music, and games. 

But it's also much more expensive that the workhorse 
Apple, the He. And hard-nosed, working computer 
users demand machines with substance (read 'power' 
and 'productivity'). They're not so impressed with 
dazzling art or booming sound. 

So why trade your veteran lie for an Apple IIGS. 
SoftSwitch is one very persuasive reason. 

Save The Universe Or Save Your Job? 

In its simplest form, SoftSwitch is a program switcher 
for the Apple IIGS, an application that lets you load 
three different programs into your expansion memory 
card and move freely from one to the other and back 
again. Since the programs are stored in RAM, not on 
disk, each move takes only a couple of seconds. 

Those who have never experienced the luxury of 
abundant RAM might be impressed by this feature 
alone. Others may suspect that the ramdisk capability 
built into the Apple IIGS could provide similar results. 

Actually, though, SoftSwitch is far more than a mere 
program switcher. In fact, it's like having three 
computers running at the same time. 

Consider this: You're at work. It's your lunch hour/so 
you load your favourite game and play all the way to 
level 33. No one has ever been this far before. You 
hear the clock click - one o'clock. Should you save the 
world or your job? 

Instead of facing this dilemma, you simply press the 
Open-Apple-Control-Escape sequence on your 
business-bound Apple MGs. Now you're inside the 
Desk Accessory Menu. In addition to the Screen 
options, you see SoftSwitch listed as a Classic Desk 
Accessory. 

You enter the SoftSwitch screen and press a few keys. 
Suddenly you're back in your word processor, exactly 
where you left off an hour before. 


Suspended Animation 

Unlike a ramdisk, SoftSwitch stores the entire contents 
of the computer's active memory in one of three 
SoftSwitch workspaces on the expansion memory card. 
When you want to revert to a previously saved 
application, that workspace is restored to the active 
memory area in exactly the same condition as it was 
when you left it. 

You can stop work on a program at any point and save 
it in a state of suspended animation. When you switch 
back to that program, everything is just as it was 
before. This is the major benefit of SoftSwitch. 

It's not hard to think of some potential applications. 
Load a word processor and a spelling checker. After a 
little practice, they'll work together so smoothly you'll 
forget they're separate programs. Let a co-worker or 
friend use your computer, without the inconvenience 
of saving your data or text files and rebooting later. As 
the mood strikes, you can play a game, write a 
program, and update your database without missing a 
beat as you juggle jobs. 

More Than A Switcher 

As noted earlier, however, SoftSwitch isn't just a 
program switcher. Part of the package is several 
utilities to simplify a variety of tasks. 

'Install' adds SoftSwitch to a hard disk or any ProDOS- 
16 System Disk. The entire process takes about five 
minutes. Once done, SoftSwitch automatically loads 
whenever that disk boots. In effect, SoftSwitch 
becomes an integral part of your Apple's operating 
environment, always available from the Desk 
Accessories Menu. 

Have you ever wished you could capture a hi-res 
screen from one program and then paste it into 
another? SoftSwitch's 'Screen Manager' captures and 
moves hi-res and double-hi-res screens, as well as 40- 
and 80- column text screens. Captured screens can be 
saved directly to disk or passed between graphics 
utilities. 

Screen Manager can even transport graphics from one 
operating system to another. For instance, you could 
create a picture with Baudville's Blazing Paddles (DOS 
3.3) and move it to Broderbund's Dazzle Draw 
(ProDOS). Once the graphic is pasted in, the receiving 
program can manipulate the image just as if it was an 
original creation. 

'Keepsake', another utility on the SoftSwitch System 
Disk, saves the entire contents of a SoftSwitch 
workspace on a 3.5 inch disk. 

That means you can keep that interrupted game 
indefinitely. When time permits, you can use 
Keepsake to reload the game at the exact point you left. 
This ability to trap and save the entire contents of 
active memory suggests several other more mundane, 
though practical, possibilities. 
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Lots Of Memory 

Two characteristics distinguish great utilities from the 
merely interesting: usefulness and versatility. The more 
experienced you become with SoftSwitch, the more 
uses you'll find for it. 

However, any program that tries to interact with the 
overwhelming array of operating systems and software 
available for the Apple II line is bound to encounter 
some incompatibilities. 

SoftSwitch works with DOS 3.3, ProDOS 8, and most 
earlier versions of ProDOS. It is not compatible with 
ProDOS i.1 .i since that version prevents normal access 
to the Apple IIGS Desk Accessory Menu. 

Nevertheless, it's usually quite simple to replace 
ProDOS 1.1.1 with a different version or to bypass that 
operating system by loading programs from the 
DeskTop. 

Likewise, SoftSwitch cannot switch ProDOS-16 
applications. Those programs often require massive 
amounts of memory - usually 512K or more. To support 
the three auxiliary workspaces and the active 
workspace under such conditions would require two 
megabytes (or more) of expansion. Most Apple IIGS 
owners just don't have that much RAM. 

Even with out support ProDOS-16, SoftSwitch gobbles 
memory in large blocks. Each workspace demands 
133K of expansion card RAM. Therefore, a IIGS with a 
total of 512K can use only one of the three available 
storage workspaces. Under this condition, true 
switching is impossible. 

SoftSwitch's publisher suggests a minimum of 512K 
RAM on the expansion card. When added to the 
motherboard's standard 256K, this means a minimum 
total of 768K. Users who want to maintain a small 
ramdisk and use SoftSwitch to full advantage will need 
a full megabyte or more of extra RAM. 


Nasty Combinatio 

There are other incompatibilities as well. A few 
programs prevent access to the HGs Desk Accessory 
Menu, making SoftSwitch inaccessible. AppleWorks 
2.0 needs kid-glove treatment because it interferes 
somewhat with the normal operation of SoftSwitch. 
Flight Simulator just doesn't function. 

Some protected programs force you to use their Quit 
option before going on to other software. In addition 
to booting the next disk, these Quit routines sometimes 
clear all RAM. 

For these, and most other compatibility problems, the 
thorough manual suggests relatively simple fixes. More 
serious problems are explained with refreshing 
candour. 

To help familiarize users with SoftSwitch, the manual 
also includes an excellent, step-by-step tutorial. Once 
you've finished the tutorial, you should have little 
trouble using this utility with your own combination of 
programs. 

On the whole, SoftSwitch is a thoughtfully designed 
and skillfully implemented utility that provides 
impressive capabilities never before available to Apple 
users. Good value for the money, a 30-day 
"unconditional guarantee of satisfaction'" and long¬ 
term technical support make it a noteworthy bargain. 
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MathTalk Fractions 
Review 


by Terry Cass 
Reprinted from GS Users 



"Welcome to Mathtalk Fractions". That's how the 
synthesized yet realistic voice of Professor Matt A. 
Matics greets you when you boot up Mathtalk 
Fractions, and indeed his friendly approach sets the 
tone for the whole program. The Professor reappears 
frequently throughout the modules to introduce 
activities guaranteed to seduce kids into trying drill and 
practice problems covering fractions, decimals, and 
percentages. 

Although the program includes no real tutorials, 
Mathtalk Fractions is motivating and effective 
nonetheless. Make sure you have enough RAM though 
this one requires 768K just to get off the ground. 

EXPLANATIONS 

Mathtalk Fractions comes on one 3.5" disk, and 
contains a 35 page booklet with a description of the 
program's objectives, an overview of activities, there 
are no specific lesson plans or teacher student support 
such as worksheets. 

The first several pages of documentation define terms 
such as fraction, lowest terms, decimal, and so on. The 
remainder explain how to convert fractions to decimals 
and percentages, and how to reduce fraction to lowest 
terms. 

I'd much rather see a disk tutorial. Kids who don't 
understand fractions aren't likely to stop playing long 
enough to refer to a wordy text. Pairing weak students 
with better ones in co-operative learning and play 
situations may overcome this shortcoming, though. 

This leaves the tutoring to able students and lets 
Mathtalk work as good drill and practice. 

TAKE YOUR PICK 

From the main menu, you can choose one of four 
activities - Problem Factory, Fraction Shuffle - Fun 
House - and Team Challenge. 

Problem Factory 

Here you create your own three part equation for 
decimals or fractions. Enter the parts of your 
multiplication, division, subtraction, or addition 
equation at the top of the screen. The whole line might 
look something like this:- 

44.2 X 10.5 = ? 

Having created your own question, you now have to 
answer it. The program lets you know whether you're 
right or wrong and awards points for correct answers. 


The problem factory is the least impressive of 
Mathtalk's activities. For one thing, the only "problem 
solving" here is figuring out how to enter the operand 
sign into an equation without any clear instructions. 
Second, it's misleading to call this activity a Problem 
Factory. It's simple calculation, not problem solving. 
Finally, without guidance most students would select 
activities they perform well to get the greatest number 
of points rather than practise weak areas. The program 
should do some pretesting to determine weak areas and 
start students with those. 

Fraction Shuffle 

Blackjack fans should enjoy this activity. You can 
"wager" your accumulated points on any of 12 
common fraction questions in a round of this game. 
Each problem is hidden behind one of 12 playing cards 
displayed on screen. Pick a card and you'll get a 
question like:- 

2/3 X 3/1 = . 

Again the student practises the four basic processes and 
must answer with lowest terms proper fractions, mixed 
numbers, or whole numbers. This activity has some 
merit if you overlook all the work you have to do with 
paper and pencil. The answer is the only thing you 
enter into the program. On the positive side, the 
wagering challenge and colourful graphics are 
incentives to play Fraction Shuffle. In the process, 
many students may increase their skill in reducing 
fractions to their lowest terms. Again, pairing students 
will add a tutorial element. 

Fun House 

The three amusing activities here Popper, Lazer, and 
Coin Drop make the most of the IIGS' graphics to 
attract students to equivalent fraction problems and 
conversion of common fractions to decimals and 
percentages. Popper simulates a circus dart throw. 

Each correct response fires a dart and pops a balloon to 
score points. You can play the easy (for two points), 
medium (for three points), or difficult (for five points) 
game. The sizes of the numerators and denominators 
determine the level of difficulty. The main skills tested 
here are finding the common denominator and 
reducing the answer to lowest terms. 
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I liked Popper, waiting to hear the balloons "pop" 
motivated me to figure out the answers. My only 
complaint is having to wait a good 15 seconds for the 
program to retrieve each new question. 

The Lazer game uses two types of questions to drill 
students on lowest terms and equivalence of fractions. 
In one form, you examine a rectangular box divided 
into equal segments, some of which are coloured. The 
task is to determine the fraction of the box that's 
coloured. For example, in an eight segment box with 
four sections coloured red, one half of the box is red. 
For youngsters who haven't grasped the concept of 
fractions, the boxes provide a more concrete model. 

The alternate questions require a little more thought. 
These are true or false questions comparing whether or 
not two fractions are equivalent. For example:- 

Does .19 equal 3/20? 

To answer, you have to convert both numbers to the 
same type, decimal or common fraction and then 
decide. This activity forced my students to evaluate 
relationship between decimals and common fractions. 
That's a better approach than programs that simply 
require recalling facts. 

Coin Drop is a variation of the old probabilities game 
in which you guess the number of times a flipped coin 
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will turn up heads or tails. The Professor's elaborate 
machine drops, flips, and flops the coins after you 
guess the outcome for a set number of tries. It's cute, 
but any learning here occurs after the game when you 
convert the outcome (say six heads out of ten drops) to 
fraction and percentage scores. Every time you're 
correct, you score points. 

Team Challenge 

In the Team Challenge, you compete for points in a 
game show format to practise fraction, decimal, or 
percentage questions. From a gallery of six whacky 
characters with names like Amelia Brainer, Ida Know, 
and Bart Reducer, you choose a team of three against 
whom you'll compete. 

Some characters are better at maths than others. 
Beating the top players (those identified with four 
asterisks) gets you 40 bonus points. You get only ten 
points for beating the easy characters. For any red 
blooded sixth grade kid, the challenge to go for the 
high score will be irresistible. 

At the easy level. Team Challenge focuses mostly on 
adding and subtracting fractions and decimals. Other 
questions at this level test your ability to convert mixed 
numerals back and forth. 


The harder level challenges your knowledge and 
mental agility as you equate ratio, decimal, fraction, 
and percentage expressions within a brief time limit. 

For example, you may have to express 13/52 as a 
percentage. This a subtle, effective way of making you 
apply the rules for finding equivalent fractions. Playing 
this game often enough will increase your 
understanding of the meaning of fractions and 
relationships between terms such as ratio and percent. 

Team Challenge will also reinforce knowledge of 
processes. For example, one question may ask you to 
divide 8.973 by 0.38 and show the answer to the 
nearest hundredth. If you don't know the process, 
you'll need to refer to the back of the documentation 
for the proper steps. Because that would cost you 
points, learning the process becomes important. 

FINAL MARKS 

The IIGS is an exciting machine. Most teachers would 
prefer, however, to see its capabilities for sound and 
graphics matched with software that tutors students. 
Nevertheless, good drill and practice still has its place. 

You can use Mathtalk Fractions effectively to reinforce 
essential concepts and processes and to promote 
understanding of the relationships among decimals, 
percentages and fractions. Mathtalk gets a B from the 
teacher, but an A from the student. 
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Random Lines 

Peter J. Carter 

It started with that screensaver on the Mac SE/30 waiting to show its paces. Instead of the jumping clock, the 
bursting fireworks or the streaming spots it was a set of lines and shapes whiphiraced an erratic course across the 
screen. Quit^ fn^srrlerising. ^ 

IIMI® 


All i.tneeds is a queue or two to 


of the lines: 



local ; : [po s ahg 10 ] 

PU SETPOS FIRST :p<j)S 
SETH,FIRST • : angles f- 

fd: .3 •. :: 

L^KEX''poS. : PCS. 

+. RANDOM 20 
a ngi e HE ADI NG • 
l."+ RANDOM 5 
:length 
0 PU 

SETPOS LAST :positions 
SETH ''LAST : •: angle 

PD : 'FD' ; :V;lengt 
Lines' FPtJT 

END . . JlP^' 


RT.: 8 Q: 
MAKE:-; 
SETPC 

pd : ;fd : 

SETPC 


MAKE 
MAKE 
0 ] [0 
MAKE 


'staMAngle#f i: !?0 90 9(^0$ 90-90 9 0: 90 90 90 90 90 90 90 903 
'startP-^ : 10 0] {O^lo 03 tQ 0] [0-0] [0 0] (0 0] [0 0] [0 0] CO QllMM [0 0] [0 
0] [0 Oil 

'lenatfaga^ 1" \ ■ 

. 



By starting out with queues full of d&nmy \^ues we avoid the problem of building them up and deciding when 
they're long enough. You can have asYnany vite as you like (usethe editor's copy function), the more values 
the more lines on the screen at once. Vou can al^pta^^bout with : 1 engt h and the RANDOM values. Instead 
of plain lines, try shapqlf with a procedure in place of Ejy 
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% File Edit 



Uirus Checkers 


. 28 items 

16J57K in disk 

51,009K available 


fc\ 




1_riUIR 

AntiVirus 1 .OE AntiPan Antiviral 1.0 Assassin 



© 



4.1 Bug Sniffer BootCheck Compare 


< 3 ^ 



DeskCheck Disk First Aid 1.4.1 Disinfectant 





Interferon 2 Interferon 3.C Interferon 3.1 


n 

Ferret 1.0 GateKeeper 

\ 

B 

nVIR Vaccination 




N.O.M.A.D. 1.0 


RE2 

<s> 




Be 


Repair REdit ResEdit 1.2b3 RWatcher 


jJIRUS 


WARN!! 



Vaccinel .0 Vaccination 


Virus Rx 1.4a 1 


VirusWarning Vital Signs Warning 




Virus info files 


\ 
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At the August Mac meeting at the town hall an interesting discussion 
on the computer virus problems prompted me to put together the 
following bits and pieces. Most of it comes from the documentation 
accompanying the various virus checker programs around. I find I 
disagree with many of the ‘rules’ set forth in various solutions - but 
what may work for one user does not necessarily follow for all. 


Antiviral 1.0 is an application which is designed to 
help you prevent your computer system from 
succumbing to a viral infection. It does this by 
monitoring the size of applications (the files by which 
infection is most frequently spread) and alerting you 
when applications change size between one run of 
Antiviral and the next. To be effective, Antiviral must 
be run frequently—at least weekly, and more often if 
your system has many users or you often add new 
software or disks. 

Antiviral 1.0 is copyrighted ©1988 by Chris 
Klugewicz. All rights reserved. Antiviral is shareware: 
you may try it for 15 days, and if you decide to keep it, 
you are obligated to pay for it. 


A 


WARNING: The file "MacWrite 4.5" has been altered 
since Antilliral was last runl (Resource fork 
lengths unequal.) "MacWrite 4.5" may be 
infectedl 


l m .1 


Antivirus is very slow and will crash your hard disk if 
you stop it in the middle of a search for the nVir virus. 
It will repaira infected file. 

Boot Check is a simple security system designed to 
keep irritating visitors off of your hard disk. This is 
done by performing a security check when starting the 
system. 

Boot Check was written by John Rotenstein / 2/88. 
Mail: PO Box 165, Double Bay NSW 2028, AUST. 
ARPA/UUCP/ACSnet: johnr@runx.ips.oz.au 



4.1 Bug Sniffer is a quick hack to help get a grip on 
the plague of crashing programs that appeared with the 
advent of System 4.1. 

These are mainly programs compiled with the 
Megamax C compiler, which uses an undocumented 
low-memory variable called "BasicGlob" (so-called 
because it was to have been used by Apple's never- 
released Mac Basic). When System 4.1 came along, 
this was the last unused low memory variable, so 
Apple used it to point to a block of new ones. 

This all works fine, until a Megamax C application 
comes along, and trashes that pointer. The Macintosh 
then crashes. 

DeskCheck, a tiny application which checks to see that 
everybody's bundle (BNDL) is correctly constructed. 
Errors in bundle construction can propagate to the 
desktop file, causing no end of trouble for the Finder, 
including system hangs and bombs, and an unusually 
bloated Desktop. Finder 5.3 is relatively good about 
protecting itself, but earlier Finders were sitting ducks. 
Note that DeskCheck only looks for problems. Beyond 
telling you, it doesn't *do* anything about them. 

That's a job for ResEdit. 

As a Mac application, DeskCheck is a sorry example. 
It's utterly modal and provides only minimal user 
control over the files to be checked. Its purpose, 
however, was to quickly find problems in a large 
collection of PD and shareware stuff. Since the source 
code is included, someone with lots of spare time can 
improve the user interface. 
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Interferon is a program that detects and destroys digital 
viral infections. It currently recognises the modus 
operandi of several of the virus strains, and will be 
updated to recognise other strains as they appear. 

inteferon is FREE. Although it is a copyrighted program 
(and not public-domain!), you have my permission to 
reproduce and distribute it as much as you want. In 
fact, spread it far and wide - as far and wide as the 
plauge it is intended to cure. 

However, if Interferon helps you kill viruses on your 
computers, please consider how much time the 
program saved you (killing infections by hand takes 
hours!). How much was that time worth to you? $10? 
$ 50 ? $ 100 ? Only you can judge. However, please 
consider writing a cheque for some fraction of that 
amount (whatever you think fair) and send it to: 

The Vision Fund 
c/o Sir-tech Development 
10 Spruce Lane 
Ithaca NY 14850 

The Vision Fund was set up a few years back to take in 
n Shareware n donations for my shareware products 
(currently 3: Reversi, MandelColor and Interferon). All 
the proceeds go towards buying some special hardware 
for a visually impaired computerist. He is going into 
college this year and we hope to get him something 
really decent. Anything left over will go to one or more 
major charities. 

The nVIR Virus 

-How the nVIR Virus Spreads and What It 
Does 

The nVIR virus is similar to the Scores virus in many 
ways. It does not appear to have malicious intent 
and is relatively harmless. Initial infection of a system 
is also caused by an application with a modified 
CODE ID = 0 resource. When a nVir carrier 
application is launched, the virus' code segment is 
executed first. This code checks for its INIT in the 
System File, and if it doesn't find it, the code copies 
the INIT there. 

Along with the INIT resource, eight 'nVIR' resources 
(0-7) are added to the System file. 

The next time the system is restarted, the INIT ID = 

32 is loaded into memory and tries to infect every 
application that is launched. The nVir virus adds a 
CODE ID = 256 resource and modifies the CODE ID = 
0 so that the nVir code is executed first. 

Again, infection of an application is determined by 
examination of the CODE ID = 0 resource. If the 
eleventh word of the resource (third word on the 
third line in the ResEdit listing) is NOT "0001", the 
application is 


Virus Rx (©1988, Apple Computer, Inc.) 

Run Virus Rx from a locked floppy disk. 

Virus Rx will list damaged applications, INIT, cdev and 
RDEV files, invisible files, altered system files, and 
altered applications. Use the scroll bar to read the 
entire list in the Virus Rx window. Virus Rx reports 
different levels of concern, from simple comments to 
"dangerous" to "fatal." 

Virus Rx first lists damaged applications. Damaged 
applications have not been infected by the virus, but 
they will not work and should probably be removed 
from your disk. 

The program next lists all INIT, cdev, and RDEV files 
(such as the Easy Access, Mouse or AppleShare files) in 
your System Folder. Many of these are common, but 
you should make sure you know why they are on your 
disks. 

Some files are normally invisible; Virus Rx checks these 
and lists them. 

AntiPan This program is a disinfectant for the 
MacMagnVIR virus which has been spresding at Otago 
University. This virus is relatively inoffensive. It will 
only cause beeping (or speech if you have MacinTalk), 
sometimes when you open applications. However it 
uses up space in memory and on disk, which could 
cause problems. 


suspect. If the third word is something other than 
"0001", convert the value to its decimal equivalent 
(the numbers are in hexadecimal). Then determine 
the resource number of the CODE resource at the top 
of the ResEdit 

resource list. If these numbers are the same, the 
application is probably infected, and should be 
replaced. Some applications will appear to be 
infected even though they are not. If the eleventh 
word of CODE ID = 0 is not 1, check the tenth word; 
if it is '4EED' the on is most likely not 

infected. The tenth word normally contains '3F3C'. 

When launching an infected application, there is a 
one in sixteen chance that you will hear a short 
system beep. We have been told that if MacinTalk is 
installed you will hear the words "don't panic”. 

How to Get Rid of the nVIR Virus 
Remove the nVIR virus the same way you remove the 
Scores virus except you do not need to throw away 
all of the files in the System Folder; just throw away 
the System file. 
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The virus is transmitted by applications and by the 
System File, so please use AntiPan on all your disks 
which contain applications or Systems. It will confer 
immunity from the known version of the virus and 
should detect variants as well. 

nVIR Assassin, by Pete Gontier, November and 
December 1988 

kudos, complaints, and bug reports to: 

Bloated Toad Software 
Microcomputer Labs UCSB 
1521 Phelps Hall 
Santa Barbara, CA 93106 

© Copyright 1988 Regents of University of California 
Portions © Copyright 1988 Symantec Corp. 

This program is designed to scan volumes on a search 
and destroy mission for the nVIR virus. It is fairly self- 
explanatory: run it, and it will tell you what it's doing 
as it does it. A few things, however, should be noted. 

The program was written with a university-type 
laboratory setting in mind. What this means that one of 
the design factors was to take into consideration 
hundreds upon hundreds of disks which might 
occasionally need sweeping (fortunately, this is not yet 
a reality, at least at our facility). If it is inconvenient for 
any reason, please consider this notion before deciding 
the interface is flawed. 

The Eject button in the opening dialog WILL eject a 
hard drive. This is a feature, not a bug. The Eject button 
will, in fact, eject anything it can get its hands on but 
the startup volume. 

VirusDetective™ Viruses leave fingerprints when they 
infect an application, your System file or any other file. 
In technical jargon these fingerprints are called 
resources. What VirusDetective™ does is provide a 
means to search for these resources using various 
matching criteria. Before I go further I should mention 
that the intention of VirusDetective™ is to detect 
viruses, not to remove them. Unless you absolutely 
know what you are doing you should not use the 
Remove button but either replace the infected file or 
use one of the various repair programs available 
(several are distributed on the VirusDetective™ disk. 
Also on this diskette are several pieces of 
documentation about the various viruses from different 
sources.) Other sources of documentation include the 
November 1988 issue of MacWorld. 

Virus Warning will beep if it finds a virus being 
installed. 


REPORT 



Current Report Types Generated by 

Interferon 

001 The SCORES virus/$6 named because it puts, amoung 
other things, a file named SCORES in your system folder. 

: 

the most sophisticated. It replicates rapidly and can cause 
your machine to behave unpredictably. If any of yoiir 
applications are infected by SCORES, assume that your 

- ^ just as much a pain. 

%0l31 ie SCORES virus is be 

creator or type. If you get this vvafhing, please let me know 
7the detail?;. : ;- 

that it is run at boot time. SCORES does this, although It 
do^s other things as well. Type 004 is a generic *Viru$ 

• sniffer” that detects if common System foider files have 
been adulterated in this way. If you get a type 004 virus, 
please get in contact, you may have discovered a new 
strain. 

005 This is an Anonialy. it detects when CODE resource #0 
jumps to the last CODE resource (Call it resource #N) and 
CODE resource N-l does not exist, This is a pattern 
; exhibited by SCORES. There may be legitimate applications 
out there that also have this pattern, thus this is flagged as 
an anomaly that you should look at further. 

006 This is an Anomaly, it detects when CODE resource #0 
jumps to the last CODE resource. It is not as selective as 
#005, and so more legitimate applications may have this 
pattern. You should examine any application that triggers 
this anomaly carefully, 

• ' ' . . . • XV ; . . ' ' ; . ■ . ■' : . ; ' 0 : 

.VO.:;-- : 0 

0v :: ; : . ' o/yo 

00S This is an Anomaly. It is set off when an I NIT resource 
appears in a non-INIT or system file. Again, this can be 
perfectly kosher and harmless. 

OS ■ 

that are wandering far from home. 

' ' ■ 0 

please let me know as soon as possible so that I can add it 
to the list and modify the program. 
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Some history about nVIR, 
all of it hearsay: 

The nVIR virus started in West Germany, in a university 
professor's office. He was studying the phenomenon of 
viruses in general when an SE was stolen out of his lab. 
This is why nVIR is not particularly damaging: the only 
thing it does besides reproduce itself is keep track of 
how many times it has done so. However, under some 
circumstances, this can take up a significant amount of 
space on a disk and can also cause printing problems. 

Unfortunately, there are rumors to the effect that this 
professor published the source code to his virus! This 
means that there can be (and probably are) strains of 
nVIR out there in the big wide world which are more 
damaging and harder to kill. I have heard of two, so 
far. One is the original version. The other was reported 
in MacWeek and is apparently a bit harder to kill off, 
but I have taken measures to take care of this. I think. 

Further recommendations: 

11 Vaccine", from CE Software. It is a free INIT which 
asks you to confirm certain sensitive reource changes 
while other progams are running. This can allow you to 
avoid infection by most any virus, although it is NOT 
foolproof. 

"Ferret", an application like nVIR Assassin which scans 
drives to repair them from "Scores" infections. 

"Interferon", an application which scans drives looking 
for a number of different viruses and "shady" files and 
optionally deletes infectees. 

All these programs are available as shareware or 
freeware on bulletin boards and national on-line 
services. 

The clincher: 

If you would like comprehensive repair services for 
disks which you suspect might already be infected, 
make sure you get a copy of "Virex", from HJC 
Software, @ $99.95 list. Their phone number is 919- 
490-1277. This program eradicates Scores, nVIR, and 
Sneak, and will be updated to take care of other 
Macintosh viruses as they appear. Remember, nVIR 
Assassin was written for the immediate needs of a 
university laboratory, and will not be updated if I can 
possibly avoid it! 


Pete Gontier 
December 1988 


Protecting Yourself and 
Your Users from Software 
Viruses 

(Unknown source) 

I totally disagree with most of this, well, it's not that I 
totally disagree, but there is a bit more to it than the 
following, which is not necessarily all strictly true. 

Basic Rules: 

1. Software to be distributed through a BBS should 
always be inspected and tested by the Sysop before 
making it available for downloading. Sysops should 
never assume users have the expertise needed to 
protect their systems. 

2. Any of downloaded or unfamiliar, non-commercial 
software should be kept on a floppy disk until its 
quality and character are determined. Don't put it 
on your hard disk. 

3. Viruses may not always show up immediately, and 
they may spread or install themselves anywhere in 
your system, so any piece of non-commercial 
software should be tested several times before 
putting it on your hard disk or exposing other 
application or system disks to it. 

A basic method for testing unknown 
software: 

Boot your Macintosh from a floppy disk. 

If you have an internal hard disk, unmount it (by 
dragging its icon into the trash) before running the 
downloaded software. External hard disks should be 
turned off. 

Using the Finder's Get Info or Print Catalog menu 
items, note the sizes of your operating system and 
related files. The size of the system changes when you 
add or remove fonts, desk accessories or other 
resources, otherwise it should generally remain 
constant. Some files, like the Scrapbook or Notepad 
files, change sizes as often as you use them. 

Put the unknown software and a familiar application 
on a floppy disk. Run the unknown software from the 
floppy several times over Check the size of your system 
file and other files in your system folder afterward; 
watch for changes in size which don't make sense. 

After using the unknown software, run the familiar 
application; watch for unusual behavior. Check the 
size of the application after running it. 

Applications generally don't change their size much. 

Always backup files and application software on floppy 
disks or tape (after taking the above steps) to make sure 
your system is not infected. If it appears your system or 
applications have been corrupted by a virus, reformat 
the disk and restore its contents from your backup or 
original software disks.. 
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AntiPan • Virus Rx • Interferon 


This Disk is a compilation of Virus Protection Software which is 
composed of three sections. They are ... 

1. AntiPan 

2. Virus Rx 

3. Interferon 

We suggest that you run all three in this order to achieve maximum 
detection and removal of any known viruses. We are unfortunately 
unable to remove any unknown or more recently developed viruses. 
Should you suspect that your equipment is being affected by a virus 
please notify us immediately. 

Please do not panic if you think you have a virus, and, to help us in 
solving your problems we would appreciate it if you took every care 
to check all other causes of problems in case they are no more than 
a case of exhausted software or (dare I mention it), operator error. 

IMPORTANT 

This disk must never be unlocked. A virus cannot infect a locked 
disk. 

The "AntiPan" application was created by Michael Hamil of Otago 
University. This Application will remove the "nVir" virus from 
applications and System Files. To start the process, simply launch the 
"Antipan" application on this disk. This Application will not be able 
to remove the "nVir" from the Application DA Handler. If you do 
have DA Handler ( an Application which enables Multi Finder to 
manage your DA's more successfully). This will have to be removed 
manually and replaced from an uncontaminated set of System Disks. 

The "Virus Rx" Application will scan disks for the "Scores" virus. 
Again the Application should always be run from a locked startup 
disk to be effective. Documentation is provided on this disk. 

"Vaccine" is an Init System File that provides partial protection 
against viruses. Documentation is also provided on this disk. 

For further technical advice and assistance please contact your 
normal Technical Support channels. 

CED (1988) Ltd. accepts no responsibility for any ill effects caused 
by the use of this Disk. (And neither does Delairco Electronics 
Limited). 

COMPUTER VIRUSES 

This article was last reviewed on the 15th of April 1988 

GENERAL ISSUES 

What is a virus? 

A virus is a program with two distinct functions: 

It spreads itself from machine to machine (self-reproducing code). 
This includes the actual infection of other systems as well as the 
stashing away of code into as many "carriers" as possible. It 
implements the "symptoms" planned by the perpetrator of the virus. 
This could be any number of things, up to and including erasing a 
disk on a specific date. 


A Bit of History 

Computer viruses have been around for almost as long as computers. 
John Van Neumann, the father of the modern computer, toyed with 
the idea of self-reproducing computer code as early as 1948. In the 
late 1970s, there was even a training ground for the writing of 
viruses. It was a program called Core Wars that implemented an 
artificial environment pitting two virus programs against each other. 

Viruses Are Not Unique to the Macintosh 
The Macintosh is not the only system to be plagued by viruses. 
Mainframe and minicomputers are also targets for virus programmers. 
One of the more recent mainframe incidents was the virus that 
invaded IBM's mail system and brought it to its knees for a couple of 
days. IBM PC users have been experiencing viruses for several years 
now. The most common method of attack is through the 
COMMAND.COM file. The Macintosh community has been lucky to 
have gone so long without virus programming becoming the thing to 
do. 

Not All Viruses Are Meant To Be Damaging, But... 

Viruses are not all meant to be damaging. The programmer may just 
want to prove he can do it and have the satisfaction of reading about 
it in magazines and on the BBS network. Sometimes, these viruses 
can cause problems anyway. For example, the virus that has 
prompted this series of articles was meant to be benign except in 
specific cases. However, it takes up memory and processing time and 
has caused random side effects such as printing problems and system 
crashes. 

Don't Panic; Don't Overeact 

If you think that you have a virus, it's important to not overeact. It is 
important to take a step back and evaluate the situation calmly. Once 
you know that you have a virus and what it has infected, it is a 
relatively easy thing to combat. These documents contains enough 
information for you to be able to deal with most viruses. 

Unix Viruses 

In all of this, there has not been much discussion of Unix viruses, but 
they do exist, and the spread of public domain software is almost as 
great in the Unix world as it is in the microcomputer world. 
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Public Domain Issues 

Most viruses spread via public bulletin board 
systems and are hidden in public domain 
programs. "Sexy Ladies/' a program distributed 
at a MacWorld Expo in San Francisco, erased 
whatever hard disk or floppy disk it was on 
when it was launched. 

Network Issues 

The use of networks can easily enhance the 
spread of a virus. Different scenarios are 
possible, with the simplest being a public 
domain folder on a server that everyone gets 
the latest neat stuff from. Also, shared 
applications residing on a server could 
become infected, which would then infect 
every machine that those applications were 
run on. 


When Da You Suspect You Might Have a Virus? 

When your computer begins to do things out of the ordinary, or 
when it stops being able to do things it has always done in the past. 
The problem with this is that corrupted system files can lead to 
similar symptoms even though a virus isn't involved. When problems 
occur, they are much more likely to be the result of non-virus 
difficulties. When you have ruled out the standard problem areas, 
you should look into the possibility that your system has been 
infected by a virus. 

What to Look For If You Think You Have a Virus 
Look for invisible files in your System folder that don't belong there. 
Unless you specifically have an application that creates invisible 
files in the System folder, every invisible file in the System folder 
should be suspect. Also, a general check of all the files in your 
System folder for resources that don't belong in those files is well 
worth the effort. 

Files and Resources a Virus Might Infect Any and all 
applications 

HyperCard Stacks (the MacMag virus was spread via a HyperCard 
stack) 

Files in the System folder, including: 

System 

Finder 

Note Pad file 
Scrapbook file 
Clipboard file 
Easy Access 
Sound 
Mouse 

Startup Device 

Monitors 

Colour 

General 

Keyboard 

LaserWriter 

ImageWriter 

AppleTalk ImageWriter 

ImageWriter LQ 

In other words, all system files. 

Files a Virus Might Damage Inadvertently Any file on an infected 
volume or system, including system files, documents, applications, 
etc. 


TECHNICAL ISSUES 
How Viruses Propagate 

Viruses can propagate by a variety of methods. The most common 
way for a Macintosh virus to replicate itself is to have an I NIT that 
installs a background (VBL) task that checks for specific occurrences, 
such as a disk insertion, and then copies itself somewhere to that 
disk. 

VBL Tasks 

The Macintosh has always had a limited form of background 
processing available to it through the use of the Vertical BLanking 
queue. Every time the screen on a Macintosh (except for a 
Macintosh II) is refreshed, any routines installed in the queue are 
executed. The Macintosh II has a dummy VBL queue for 
compatibility reasons since the advent of a variety of screens has led 
to different vertical retrace periods. 

VBL tasks can be installed in the queue by any program. The 
program has to load a routine into a section of memory and install 
the routine into the VBL queue by calling the Vinstall ROM routine. 

It is the responsibility of the installing program to make sure the 
segment of memory containing the routine remains available even 
after the program has exited. Each VBL task has a specified time 
period it should be left "asleep" before it is called. Every time the 
routine is executed, a counter is decremented for that routine. When 
that counter reaches zero, the routine is deleted from the queue 
unless the routine itself resets the counter. 

Lengthy VBL tasks such as the one that might be used to replicate a 
virus can interfere with the normal operation of the Macintosh by 
interrupting processes that shouldn't be interrupted. A perfect 
example of this is printing to a LaserWriter over an AppleTalk 
network. If a VBL task takes too long in its execution, the printing 
process could terminate abnormally and leave the machine's 
connection to the network in an unstable state. 

For the purposes of a virus, an INIT is most likely to be the culprit 
responsible for installing a VBL task. 

INITs 

INITs are routines that are run when the Macintosh is booted. For the 
most part, they have full access to all of the commands normally 
available to a standard Macintosh program. The major difference is 
that the low memory globals have not been set up yet, so any INIT 
needing access to structures normally stored in low memory must 
create its own. 

INITs in the System file: 

When a Macintosh boots, the INITs in the System file in the "blessed" 
folder are the first code to be executed. These INITs should generally 
be Apple INITs only — any non-Apple INITs should be considered 
suspect. 
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The INIT 31 mechanism: 

A special INIT in the System file, INIT 31, was created to allow for 
the execution of non-Apple INITs without having them installed in 
the System file itself. When all of the other INITs in the System file 
have been executed, INIT 31 walks through the System folder 
looking for files of types INIT, RDEV, cdev, and executes any INIT 
resources it finds in these files. The order in which the files get 
loaded is alphabetical. Needless to say, a simple way for hiding parts 
of a virus is to drop INITs into legitimate files already existing in the 
System folder with these file types. 

CDEVs 

The file type cdev indicates a file containing a Control Panel device. 
When the Control Panel is loaded, it walks through the directory of 
the System folder looking for any files of type 'cdev 1 . When it finds a 
file of this type, it loads the ICN# of that file (assuming it has one) 
into the list of icons shown on the left side of the Control Panel. 
When you click on the icon of the cdev in the Control Panel, the 
code in the cdev resource in the file of type 'cdev' is executed. A 
virus could easily use this mechanism as a way to infect a system, 
install a VBL task, etc. 

Many cdev files have INITs in them with the cdev controlling the 
settings that the INIT will use when it is installed. A good example of 
this is the settings for a screen blanker. The INIT actually installs the 
VBL task, but the cdev controls when dimming occurs. None of the 
standard Apple system cdev files have INITs in them, but there is 
nothing to prevent a virus installing an INIT in these files as a way of 
hiding its code. 

DRVRs 

DRVR resources typically can have one of two functions: they can be 
the code for a desk accessory, or the code for drivers necessary for 
the system to perform some function such as printing. Once again, 
the key word here is 'code'. Whenever code is involved, the 
potential arises for the perpetrator of a virus to take advantage of it. 

Just as with cdevs, when a DRVR gets opened, either by the choosing 
of a desk accessory or by the system, code is executed at that point. 
This is the stage at which a virus might fulfil its purpose. 

CODE Resources 

Each application has at least two CODE resources. The first of these 
CODE resources has an id of 0 and contains what is known as the 
jump table. This table provides the basic information necessary for 
various parts of a program to call routines in other CODE segments. 
The current rage in viruses is to modify the CODE ID = 0 resource of 
an application so that a CODE segment it installs in the application 
gets called before the application is actually run. This CODE 
segment could go out and check if the virus has infected the current 
system, and if it hasn't, install itself. All the perpetrator of a virus has 
to do at this point is upload a copy of an infected application to a 
BBS, and it spreads across the world. 


Applications that allow external procedures: 

Viruses could take advantage of the external procedures that are 
allowed by some applications. The perfect example of this is 
HyperCard, with its XCMDs and XFCNs. This is how the MacMag 
virus was transmitted. 

KNOWN VIRUSES 

The Scores Virus 

You can be almost positive your system has been infected by the 
Scores virus if the icons of your Note Pad file and Scrapbook file 
look like document icons instead of system icons. Launch ResEdit 
and look in your System folder. If you see files called "Desktop" and 
"Scores" you can be 99% sure that you have the Scores virus. 

How Scores Spreads and What It Does 

The Scores virus is relatively harmless. The initial infection is caused 
by an application with a modified CODE ID = 0 resource, and an 
additional CODE resource (first unused ID number plus 1). When the 
'carrier' application is launched, the CODE ID = 0 resource runs the 
virus installer code. This code checks for previous installation of the 
Scores virus. If the virus is not there, the virus files are installed. The 
virus consists of three INITs, one atpl, and one DATA resource found 
in the files listed below: 

If the Note Pad and Scrapbook files do not exist, they are created. If 
they exist, the type and creator of the files are altered to those listed 
above, and the corresponding resources are added to the files. The 
files still appear to function normally with the Note Pad and 
Scrapbook DAs, but their icons change to document icons. The 
Desktop and Scores files are invisible, and are created during the 
infection process. 

The next time the infected system is rebooted, the INITs are loaded 
into memory and are ready to infect other applications. The INITs 
install a VBL task that actually modifies and installs resources into an 
application. After an application has been launched, an internal 
timer is started. Somewhere between two and three minutes later, 
the open application is infected and becomes a carrier. A new CODE 
resource is added to the infected application, and the application's 
CODE ID = 0 resource is modified to execute the new CODE 
resource first, then continues with the application. 

To determine if an application is infected, examine the CODE ID = 0 
resource. If the eleventh word of the resource (third word on the 
third line in the ResEdit listing) is NOT "0001", the application is 
suspect. If the third word is something other than "0001", convert the 
value to its decimal equivalent (the numbers are in hexadecimal). 
Then determine the resource number of the CODE resource at the 
top of the ResEdit resource list. If these numbers are the same, the 
application is probably infected, and should be replaced. Some 
applications will appear to be infected even though they are not. If 
the eleventh word of CODE ID = 0 is not 1, check the tenth word; if 
it is '4EED' the application is most likely not infected. 


FILE TYPE CREATOR RESOURCES SIZE 


Desktop (invisible) 
DATA ID = -4001 
INIT ID = 10 

Note Pad File 

Scores (invisible) 
DATA ID = -4001 
INIT ID = 10 

Scrapbook File 

ID = 17 

System File 

DATA ID = -4001 
INIT ID - 6 
INIT ID = 10 
INIT ID = 17 


INIT FNDR 

INIT ZSYS 

RDEV ZSYS 

RDEV ZSYS 

ZSYS MACS 


atpl ID 

INIT ID = 6 
atpl ID = 128 

INIT ID = 6 
atpl ID = 128 


128 2410 bytes 

7026 bytes 
1020 bytes 

772 bytes 

2410 bytes 
7026 bytes 
1020 bytes 

772 bytes 
480 bytes 

2410 bytes 
7026 bytes 
772 bytes 
1020 bytes 
480 bytes 
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SAFEGUARDING YOUR SYSTEMS 



m 


■ What Makes Our System Susceptible to 


THE SCORES VIRUS A Computer virus commonly 
known as SCORES has appeared in the Macintosh community 
and confirmed in several Apple and non-Apple locations 
Worldwide. 

The virus is harmful and can cause a variety of problems. The 
SCORES virus can attach itself to applications, and files 
located in the system folder. It doesn't appear to infect 
document files or stacks. 

Apple has developed a detection tool called Virus Rx to 
determine whether or not the virus is present and what 
applications have been infected. 

Please distribute this detection program freely. Inquiries 
concerning viruses should be handled through normal 
technical support channels. 

How to Get Rid of the Scores Virus 

It is not hard to remove this virus from a system, but it 
may take some time. Here's how: 

1 . Use Font/D A Mover to copy all fonts and DAs that 
you do not have backups of to font and DA suitcase 
files (this virus does not attach itself to DAs). 

2. Start the system from a locked, not infected, floppy 
disk. 

3. Throw away the System folder on the infected disk. 

4. Use ResEdit to identify all suspect applications on 
the infected disk. 

5. Make a list of all suspect applications. 

6. Throw all suspect applications in the trash, and 
empty the trash. 

7. Reinstall the system software from a known good 
System Tools Installer Disk. 

8. Using locked masters, recopy any applications that 
were deleted from the infected disk (it is important to 
verify that the master disks have not been infected). 
You're all done. 


9 . 


MacMagVirus: We don't have much information 
regarding the MacMag virus. It was apparently 
uploaded to CompuServe, inside a HyperCard stack, in 
the form of an XCMD, and it installed an IN IT ID = 6 
with a name of'RR'. Its sole purpose in life was to 
display a "universal message of peace" on your 
computer on March 2, 1988. The virus removed itself 
after displaying this message and should be of little 
concern now. 



The various mechanisms described in part 2 of this article make our 
system easy to infiltrate by a virus. Remember that it is those same 
mechanisms that add to the flexibility and "look and feel" of the 
Macintosh. 

For instance, the IN IT mechanism is used by mail systems to load 
their code in. AppleShare uses the INIT mechanism to mount 
network volumes at boot time. 

Why Vaccine Works in This Case, But Is Easy to 
Bypass 

Vaccine, a public domain INIT written to block viruses, does a good 
job of alerting you when the three known viruses are trying to infect 
your system. The problem with Vaccine: once a cure is found for one 
set of viruses, a new strain may appear that knows how to bypass the 
existing defenses. 






LOCK YOUR MASTER DISKETTES 

Always keep original "Master" disks locked. This prevents a virus 
from spreading to your original disks. Our disk locking mechanism is 
hardware based -- viruses can't infect locked disks! 

PROTECT YOUR NETWORKS 

Network administrators should not allow just anyone to put software 
on the server. Applications on a network server should come only 
from known good masters. 

BE WARY OF PUBLIC DOMAIN SOFTWARE 

Public domain software should be checked quite thoroughly on a 
floppy-based system for any infections before being copied to a hard 
disk based system. This will also protect you from any "Trojan Horse" 
programs such as "Sexy Ladies." 

QUARANTINE INFECTED SYSTEMS 

If you identify a system as being infected with a virus, immediately 
isolate (quarantine) it from other systems. This means disconnecting 
it from any network and not allowing anyone to take any files from 
the exposed system to another system. Once the system has been 
'disinfected,' you can allow the files to be copied or moved. 

USE RESEDIT 

ResEdit is a good tool to look for viruses on your disks. There is very 
little that can be hidden from ResEdit, so you can use it to remove 
troublemaking files and resources. 


Beware of "Sexy Ladies" Program 

Watch out for a Trojan Horse program that was distributed at 
MacWorld in January 1988. It's called "Sexy Ladies". When you run 
the program, it puts an abusive message on your screen, then 
ERASES your hard drive. It was distributed on a floppy named "PD". 

Since these kinds of pranks seem to be a growth industry, we 
strongly recommend that you: 

KNOW THE SOURCE OF AN APPLICATION BEFORE 
USING IT • TRY OUT ANY DUBIOUS PROGRAMS ON 
A TEST SYSTEM 

Vaccine Installation Instructions 

Vaccine is a CDEV (Control panel DEVice). Install Vaccine by 
putting it into the System Folder of your boot disk. Reboot your 
Macintosh then go to the Control Panel in your desk accessory 
menu. Scroll down until you see the Vaccine Icon and select it. For 
further instructions press your mouse in the appropriate place. 
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UNOGRAPHICS 

GRAPHIC INK 

1st Floor, 61 Flinders St 
Adelaide Ph 223 7300 

Laser output 
Linotron output 
Typesetting 
Layout 

Graphic Design 

Macintosh publishing services. 

Tfa Bkrem 
in 1fi& head qf iU dijyJ 




AUSTRALIAN 
LASER CHARGE 

Every time you throw away a 
depleted Laser Toner cartridge 
it could be costing you 
between $100 and $150. 
Here's your chance to save 
money. 

RECHARGE WITHIN 
24 HOURS 

For further details contact: 
Bryan Stokes 
AUSTRALIAN LASER 
CHARGE 
Ph: (08) 265 5397 


THINKING COMPUTER 
BOOKS? 

THINK BOOKSHELF 

<ik booksheTf1% 

170 Pulteney Street, Adelaide 
Telephone 223 3899 

S.A. Agents for Law Book Co. 

10% off on production of 
SAAUC membership card 
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Excuse me, I'm just off to pick up my new Mac, the 
Mac llci - it's only about 15% more than the Ilex and 
has 1, 2, 4 and 8 bit video on board - freeing up all 
those nubus slots. The llci's vedeo chip uses main 
memory instead of dedicated video RAM and takes 
advantage of 100ns or faster chips. 

What else? Well let me see ... Built-in 8-bit 
colour video, 25MHz 68030 processor, 120-pin 
processor direct slot and oscillators for 3 Apple 
monitors. 

Or how about a portable Mac 17 pound, 2Mb 
of RAM and a 40Mb internal hard disk for about 
$US6,500. The screen is a black and white 
active matrix display. (Clock speed ... hmmm . 
look for two models 16MHz and 33MHz.) 

Want to hang on to your old SE - new SEs will ship 
with the 1.44Mb SuperDrive - at the same prices as 
the old drive.Mac lls (the common variety kind) could 
be going out of production - but wait for a 33MHz 
Mac II model.real soon. 

Of course these are only rumours, but don't forget _ you 
read it here first in AppleSauce not Mac. 


Club Public Domain Disk Prices 



Apple ][ 
Apple ][ GS 
Macintosh 


$4.00 

$7.00 

$8.00 























































































